CVE-2026-13592

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13592", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-29T05:04:24.896Z", "datePublished": "2026-06-29T17:15:11.042Z", "dateUpdated": "2026-07-01T14:09:20.873Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-29T17:15:11.042Z"}, "title": "liftoff-sr CIPster EtherNet IP Message append out-of-bounds write", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "Out-of-bounds Write"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "liftoff-sr", "product": "CIPster", "versions": [{"version": "e8e9dba09bf56962807d3504b783ccdb6287f3e4", "status": "affected"}], "cpes": ["cpe:2.3:a:liftoff-sr:cipster:*:*:*:*:*:*:*:*"], "modules": ["EtherNet IP Message Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. Affected by this issue is the function BufWriter::append of the component EtherNet IP Message Handler. Performing a manipulation results in out-of-bounds write. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named 3a0159ed43125dcd024a1965f0289cb186bae9ff. To fix this issue, it is recommended to deploy a patch."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-06-01T00:00:00.000Z", "lang": "en", "value": "Vendor acknowledged"}, {"time": "2026-06-01T00:00:00.000Z", "lang": "en", "value": "Exploit disclosed"}, {"time": "2026-06-29T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-29T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-29T14:09:12.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Chuan Wei", "type": "finder"}, {"lang": "en", "value": "Carnegie (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "Carnegie (VulDB User)", "type": "analyst"}], "references": [{"url": "https://vuldb.com/vuln/374596", "name": "VDB-374596 | liftoff-sr CIPster EtherNet IP Message append out-of-bounds write", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/374596/cti", "name": "VDB-374596 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-13592", "name": "CVE-2026-13592 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/844566", "name": "Submit #844566 | liftoff-sr CIPster master (reproduced on 1802525be27d33e19a9a83c163e331a1d13b1892) Out-of-bounds Read/Write", "tags": ["third-party-advisory"]}, {"url": "https://github.com/liftoff-sr/CIPster/issues/48", "tags": ["issue-tracking"]}, {"url": "https://github.com/liftoff-sr/CIPster/issues/48#issuecomment-4596727632", "tags": ["issue-tracking"]}, {"url": "https://github.com/user-attachments/files/28452971/poc.zip", "tags": ["exploit"]}, {"url": "https://github.com/liftoff-sr/CIPster/commit/3a0159ed43125dcd024a1965f0289cb186bae9ff", "tags": ["patch"]}, {"url": "https://github.com/liftoff-sr/CIPster/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"references": [{"url": "https://github.com/liftoff-sr/CIPster/issues/48", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-01T14:08:09.537127Z", "id": "CVE-2026-13592", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T14:09:20.873Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13592", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T14:08:09.537127Z"}}}], "references": [{"url": "https://github.com/liftoff-sr/CIPster/issues/48", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T14:08:42.521Z"}}], "cna": {"tags": ["x_open-source"], "title": "liftoff-sr CIPster EtherNet IP Message append out-of-bounds write", "credits": [{"lang": "en", "type": "finder", "value": "Chuan Wei"}, {"lang": "en", "type": "reporter", "value": "Carnegie (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "Carnegie (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:liftoff-sr:cipster:*:*:*:*:*:*:*:*"], "vendor": "liftoff-sr", "modules": ["EtherNet IP Message Handler"], "product": "CIPster", "versions": [{"status": "affected", "version": "e8e9dba09bf56962807d3504b783ccdb6287f3e4"}]}], "timeline": [{"lang": "en", "time": "2026-06-01T00:00:00.000Z", "value": "Vendor acknowledged"}, {"lang": "en", "time": "2026-06-01T00:00:00.000Z", "value": "Exploit disclosed"}, {"lang": "en", "time": "2026-06-29T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-29T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-29T14:09:12.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/374596", "name": "VDB-374596 | liftoff-sr CIPster EtherNet IP Message append out-of-bounds write", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/374596/cti", "name": "VDB-374596 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-13592", "name": "CVE-2026-13592 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/844566", "name": "Submit #844566 | liftoff-sr CIPster master (reproduced on 1802525be27d33e19a9a83c163e331a1d13b1892) Out-of-bounds Read/Write", "tags": ["third-party-advisory"]}, {"url": "https://github.com/liftoff-sr/CIPster/issues/48", "tags": ["issue-tracking"]}, {"url": "https://github.com/liftoff-sr/CIPster/issues/48#issuecomment-4596727632", "tags": ["issue-tracking"]}, {"url": "https://github.com/user-attachments/files/28452971/poc.zip", "tags": ["exploit"]}, {"url": "https://github.com/liftoff-sr/CIPster/commit/3a0159ed43125dcd024a1965f0289cb186bae9ff", "tags": ["patch"]}, {"url": "https://github.com/liftoff-sr/CIPster/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. Affected by this issue is the function BufWriter::append of the component EtherNet IP Message Handler. Performing a manipulation results in out-of-bounds write. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named 3a0159ed43125dcd024a1965f0289cb186bae9ff. To fix this issue, it is recommended to deploy a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-29T17:15:11.042Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13592", "state": "PUBLISHED", "dateUpdated": "2026-07-01T14:09:20.873Z", "dateReserved": "2026-06-29T05:04:24.896Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-29T17:15:11.042Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:liftoff-sr:cipster:*:*:*:*:*:*:*:*"], "modules": ["EtherNet IP Message Handler"], "product": "CIPster", "vendor": "liftoff-sr", "versions": [{"status": "affected", "version": "e8e9dba09bf56962807d3504b783ccdb6287f3e4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. Affected by this issue is the function BufWriter::append of the component EtherNet IP Message Handler. Performing a manipulation results in out-of-bounds write. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named 3a0159ed43125dcd024a1965f0289cb186bae9ff. To fix this issue, it is recommended to deploy a patch."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en liftoff-sr CIPster hasta e8e9dba09bf56962807d3504b783ccdb6287f3e4. Afectada por este problema es la funci\u00f3n BufWriter::append del componente Gestor de Mensajes EtherNet IP. Realizar una manipulaci\u00f3n resulta en escritura fuera de l\u00edmites. La explotaci\u00f3n remota del ataque es posible. El exploit es ahora p\u00fablico y puede ser usado. Este producto sigue un enfoque de lanzamiento continuo para la entrega continua, por lo tanto, los detalles de la versi\u00f3n para las versiones afectadas o actualizadas no se proporcionan. El parche se llama 3a0159ed43125dcd024a1965f0289cb186bae9ff. Para solucionar este problema, se recomienda desplegar un parche."}], "id": "CVE-2026-13592", "lastModified": "2026-10-25T21:10:00.770", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13592", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-01T14:08:09.537127Z", "version": "2.0.3"}}]}, "published": "2026-06-29T18:16:37.103", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/liftoff-sr/CIPster/"}, {"source": "cna@vuldb.com", "url": "https://github.com/liftoff-sr/CIPster/commit/3a0159ed43125dcd024a1965f0289cb186bae9ff"}, {"source": "cna@vuldb.com", "url": "https://github.com/liftoff-sr/CIPster/issues/48"}, {"source": "cna@vuldb.com", "url": "https://github.com/liftoff-sr/CIPster/issues/48#issuecomment-4596727632"}, {"source": "cna@vuldb.com", "url": "https://github.com/user-attachments/files/28452971/poc.zip"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-13592"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/844566"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/374596"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/374596/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/liftoff-sr/CIPster/issues/48"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-787"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e8e9dba09bf56962807d3504b783ccdb6287f3e4"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "CIPster", "source": "cna", "vendor": "liftoff-sr"}, "product": "cipster", "vendor": "liftoff-sr"}], "created": "2026-06-29T20:30:03.231276+00:00", "updated": "2026-06-30T00:30:06.268038+00:00", "vendors": ["liftoff-sr", "liftoff-sr$PRODUCT$cipster"]}